Fact-check findings
What an automated fact-checker found when it re-read CrossCurve against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in the timeline
“2026-03”
reviewerQuillAudits published its post-mortem in March 2026The QuillAudits write-up is dated 3 February 2026, not March. The fetched page did not show the exact figure $1,441,892.31; it showed a title/summary of about $1.4M.Proposed correction (not yet applied)2026-02
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #4[unverifiable][awaiting moderator]in section: February 2026 bridge exploit
“The exploit was executed across multiple chains including Ethereum, Arbitrum, Optimism, Base, Mantle, Kava, Frax, Celo and Blast.”
reviewerThe exploit hit a specific list of chains including Base, Mantle, Kava, Frax, Celo and BlastOnly Arbitrum and Ethereum were confirmed in the sources I fetched. I did not check the other cited articles for the full list.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #6[link rot][awaiting moderator]in section: Post-exploit security audit
“https://www.mexc.com/news/1028361”
reviewerHashlock audit of CrossCurve contracts is documented at the cited MEXC URLThe only source for the Hashlock audit claims (March 2026 date, file list, 1 medium / 3 low / 1 QA, 'Secure') now returns 410. The audit claims are currently unsupported by a live source. - #7[link rot][awaiting moderator]in the timeline
“https://www.mexc.com/news/1028361”
reviewerTimeline entry for the Hashlock audit uses the dead MEXC URLSame dead URL as in sections[5]. The Wayback copy listed in sources_used might be used instead.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: February 2026 bridge exploit
“QuillAudits' post-mortem confirmed $1,441,892.31 in assets successfully removed and remaining under the attacker's control.”
reviewerQuillAudits confirmed $1,441,892.31 in assets removed and XT Exchange froze the tokensApproximate loss and the token freeze are supported. The exact cents figure and the XT Exchange name were not visible in the fetched text, so they are unconfirmed here. - #8[partially supported][awaiting moderator]in section: Team response, bounty offer and legal threats
“No public confirmation of fund recovery or of legal proceedings had been reported as of May 2026.”
reviewerThe protocol appeared to remain operational and no fund recovery was confirmed as of May 2026I found no report of recovery, consistent with the page. The page is stale on status (see subject_status) since services were later restored and an old-bridge withdrawal mode opened.
confirmed
2 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: February 2026 bridge exploit
“On-chain data reportedly tracked by Arkham Intelligence showed the PortalV2 contract balance dropping from approximately $3 million to near zero around 31 January 2026, about one day before the public announcement.”
reviewerArkham data showed the PortalV2 balance falling to near zero around 31 JanuaryMatches. Note this makes the summary's '1-2 February' start date slightly loose, but the page hedges. - #5[confirmed][no action needed]in section: Technical root cause: ReceiverAxelar access control
“Security firm Halborn attributed the exploit to weak access controls in the ReceiverAxelar contract's expressExecute-like functions.”
reviewerHalborn blog attributes the exploit to weak access controls in expressExecute-like functionsSupported. The 'confirmation threshold misconfigured at 1' detail is not in Halborn; the page hedges it with 'reportedly' and cites other sources I did not check.